[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/html/svxcss1.cxx |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

New commits:
commit 7ab38075345215879d923b3d93843cdbcf2db005
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jan 11 17:07:32 2018 +0000

    ofz#5247 Integer-overflow
    
    Change-Id: I333f8bb2d7168f43d7d85c48dd39c6ed02ca970d
    Reviewed-on: https://gerrit.libreoffice.org/47769
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/html/svxcss1.cxx b/sw/source/filter/html/svxcss1.cxx
index e442644271f2..c8049583e65b 100644
--- a/sw/source/filter/html/svxcss1.cxx
+++ b/sw/source/filter/html/svxcss1.cxx
@@ -1653,10 +1653,14 @@ static void ParseCSS1_line_height( const CSS1Expression *pExpr,
         break;
     case CSS1_PIXLENGTH:
         {
-            long nPWidth = 0;
-            long nPHeight = (long)pExpr->GetNumber();
-            SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight );
-            nHeight = (sal_uInt16)nPHeight;
+            double fHeight = pExpr->GetNumber();
+            if (fHeight < SAL_MAX_INT32/2.0 && fHeight > SAL_MIN_INT32/2.0)
+            {
+                long nPHeight = (long)fHeight;
+                long nPWidth = 0;
+                SvxCSS1Parser::PixelToTwip(nPWidth, nPHeight);
+                nHeight = (sal_uInt16)nPHeight;
+            }
         }
         break;
     case CSS1_PERCENTAGE: